SIEM & Log Monitoring

Good detection starts with the right inputs. We prioritise the sources where attacks actually show up: authentication and directory events, endpoint process and command-line telemetry, firewall and VPN logs, DNS, and the audit trails from your cloud platforms and key SaaS applications. Collecting everything is neither affordable nor useful. Collecting the right things, parsed correctly, is what makes SIEM log analysis work.

A failed login means the same thing whether it came from a domain controller, a VPN concentrator or an Azure sign-in log, but each writes it differently. Normalising these into common fields is what lets one rule catch the behaviour everywhere, instead of a dozen brittle rules that miss the source you forgot.

We connect each log source, confirm events are arriving and parsed, and check the clocks agree so a correlated timeline is actually accurate. A source that silently stopped forwarding is a blind spot pretending to be coverage, so we validate rather than assume.

Off-the-shelf rules are a starting point. We write and tune detections around real attacker behaviour and your specific environment: impossible-travel logins, credential dumping, suspicious PowerShell, new admin accounts, mass file access, cloud key abuse. Each is mapped to a MITRE ATT&CK technique so your coverage is measurable rather than a vague reassurance.

The first version of any rule fires on legitimate activity. We baseline what is normal for your business, add the exceptions, and iterate until an alert means something. An analyst who trusts the queue investigates fast. An analyst drowning in false positives misses the real one.

SOAR: automating the boring first steps

Some responses do not need a human to start them. A playbook can enrich an alert with threat intelligence, pull the related events, open a case and, where you have authorised it, take a first containment step. That shaves minutes off every incident and keeps your analysts on the decisions only people can make.

One failed login is nothing. A hundred failed logins followed by one success, then a sign-in from a new device, then a mailbox rule that forwards everything to an external address, is a business email compromise in progress. No single event is alarming. The correlation is. That is the entire argument for a SIEM over scattered point alerts.

Correlation also catches the quieter cases: a service account suddenly used interactively, an employee accessing far more records than their role ever needs, a privileged group gaining a new member out of hours. These rarely trip a single tool, but they stand out clearly against a baseline.

We store logs for the period your obligations require, in tamper-evident storage so an attacker who gets in cannot quietly erase their tracks and an auditor can trust what they see. Deleting or altering logs is a classic step in a breach, which is exactly why write-once retention matters.

ISO 27001 control A.8.15 requires logging and A.8.16 requires monitoring; PCI DSS 4.0 requirement 10 is entirely about tracking and monitoring access with a minimum retention period; SOC 2 expects demonstrable detection; and DORA requires continuous ICT incident detection. We configure retention and reporting so each of these is satisfied with evidence, not assertion.

We own the platform, the detections and the monitoring, and you get triaged alerts and monthly reporting. This is the fastest route to trustworthy detection for a company without a security team.

You keep the platform and business context; we provide detection engineering, out-of-hours monitoring and the deep analyst bench. It is a common setup for firms that have IT staff but not a 24/7 SOC.

If you want to run it yourself, we can architect the SIEM, write the initial detection content, tune it against real activity, and hand you a working system with documentation. You own it from day one, built by people who know how attacks look in the logs.

We write detections around techniques attackers actually use, not around every event a product can emit. That means fewer, sharper rules: a detection for credential dumping that keys on the specific process and access patterns, not a blanket alert on every use of a common tool. Because we run offensive engagements, we know what these techniques look like in the logs when they are done well, which is often much quieter than the textbook version.

Mapping every detection to a MITRE ATT&CK technique turns “are we protected?” into a matrix you can read. You can see which tactics are covered, which have gaps, and where the next piece of engineering should go. That makes your detection roadmap a decision rather than a guess, and it gives your board a straight answer about what you would and would not catch.

Attacker tradecraft moves and so does your estate. New detections get added as techniques emerge, old ones get retired or retuned, and the whole set is reviewed on a regular cadence. A SIEM is never finished, and treating it as a product you install once is the surest way to end up blind while believing you are covered.